---
title: "Discussion on \"Your password-reset form is a free email cannon\" | Hashnode"
description: "Discussion on \"Your password-reset form is a free email cannon\". An unauthenticated password-reset endpoint with no per-email rate limit is not just your problem. Point it at someone else's inbox and you have turned their reset form into a spam cannon, billed to your sender reputation. The fix, without leaking which emails have accounts."
url: "https://hashnode.com/posts/your-password-reset-form-is-a-free-email-cannon/6a56c78da8b1e5d630b7a69a"
---

[Feed](https://hashnode.com/feed) /

Discussion

# [Your password-reset form is a free email cannon](https://authagonal.hashnode.dev/your-password-reset-form-is-a-free-email-cannon?utm_source=hashnode&utm_medium=feed)

An unauthenticated password-reset endpoint with no per-email rate limit is not just your problem. Point it at someone else's inbox and you have turned their reset form into a spam cannon, billed to your sender reputation. The fix, without leaking which emails have accounts.

Jul 14 · 4 min read · authagonal.hashnode.dev  
Read the article

-   [#security](https://hashnode.com/tag/security)
-   [#rate-limiting](https://hashnode.com/tag/rate-limiting)
-   [#email](https://hashnode.com/tag/email)

## Written by

[Sam Critchley](https://hashnode.com/@authagonal)

@authagonal

  
[View profile](https://hashnode.com/@authagonal)

The auth platform you migrate to.

## Responses

Markdown supported · ⌘↵ to post

No responses yet.